# Integrations

> Connect WhisperGraph to your stack: the Splunk add-on, the OpenCTI connector, the Microsoft Sentinel solution, the Wazuh connector, the MISP module, the REST Cypher API, and MCP for AI assistants.

*Source: https://www.whisper.security/docs/integrations*

---
WhisperGraph has native connectors for Splunk, OpenCTI, Microsoft Sentinel, Wazuh and MISP, each documented in its own subsection: what it enriches, where to get it, and how to configure it. Everything else uses one of two open interfaces: the [REST Cypher API](/docs/cypher-api) for any tool that can send an HTTPS request, and the [MCP server](/docs/ai) for AI assistants. This page maps which path fits which job.

## Any other tool: the REST API

Any SIEM, SOAR, TIP, or ETL job that can POST JSON can integrate directly. Send Cypher to the query endpoint and get columns and rows back:

```bash expect=rows>0,no-null-columns seed=185.220.101.1 verified=2026-08-09
curl -s -A "your-app/1.0" \
  -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: whisper-YOUR_API_KEY" \
  -d '{"query": "CALL explain(\"185.220.101.1\") YIELD indicator, level, score, explanation"}'
```

The request above carries a key; [sign in](https://console.whisper.security/sign-in) to copy yours. The [HTTP API](/docs/cypher-api) chapter has the request fields, the response envelope and the status codes, and the query language itself is documented in [Cypher](/docs/cypher).

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says. `whisper.explain` does not return `coverage` at all.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/procedures/coverage).

## AI assistants over MCP

MCP-capable clients such as Claude and Cursor connect to the server at `https://mcp.whisper.security` and get graph queries, schema introspection, threat verdicts, and guided workflows as tools, with no custom code. See [AI & Agents](/docs/ai) for what the server exposes.

## Asking for a connector

The [integration contract](/docs/integrations/contract) says what a connector is expected to do. If you need one that is not listed here, tell us through [Support](/docs/support).